(HAZID) LNG Bunkering from Bunker Vessel in the Port of Hamburg

Hazard Indentification Study (HAZID) LNG Bunkering from Bunker Vessel in the Port of Hamburg

Report No. RD-ER 2011.131 Version 1.0/2012-01-06

Department RD-ER

Document Control Sheet

Client: EU Project Clean North Sea Shipping (CNSS)

Client's ref.: -

Title:

Hazard Indentification Study (HAZID) LNG Bunkering from Bunker Vessel in the Port of Hamburg

Abstract: Within the LNG Showcase in the Clean North Sea Shipping (CNSS) project, a hazard identification (HAZID) has been carried out. The scope of this HAZID is to identify the main risks which can occur during the bunkering from a LNG bunker vessel to a receiving vessel. The safety analysis of the above mentioned content was performed at the premises of the Hamburg Port Authority in Hamburg, Germany. The aim was the identification of the main risks of LNG bunkering and their possible handling. The analysis focussed on the identification of hazards caused by LNG or NG leakages. The analysis shows that five single point failures can lead to a critical situation. A number of recommendations for technical and procedural measures have been identified to prevent failures or reduce the effects of possible failures. These recommendations are listed in the documentation of this FMEA.

Department: RD-ER

Work carried out by Released by

Finn Vogler R. Plump

Lars Langfeldt Dr. G. Würsig

Revision No.: 1.0 Date of last revision: 2012-01-06

Keyword(s) No. of pages Status Gas as Fuel, LNG, HAZID, Safety Analysis, Bunkering in main body : 26

in attached tables : 32 in attached figures : - in other appendices : -

Preliminary

Final

GL internal

Report No.: RD-ER 2011.131 GL Order No.: 7990-10-66671-192 GL Reg. No.: -

Report No. RD-ER 2011.131

Date 2012-01-06

Germanischer Lloyd 1

Contents

1 Summary 2

2 Definition of project 3

3 Principle of the applied FMEA Method 5

4 Procedure for the Assessment of the FMEA results 8

5 Work principle of the bunkering between the bunker vessel and the receiving vessel 10

6 Participants 13

7 Limitations 13

8 Evaluated Operating Conditions 14

9 Evaluated Subsystems 14

10 Assessment of the FMEA results 15

11 Recommendations 22 11.1 Safety Related Actions 22 11.2 Non Safety Related Actions 23

12 Used Documentation 24

13 FMEA Documentation 25


Date 2012-01-06


1 Summary

Within the LNG Showcase in the Clean North Sea Shipping (CNSS) project, a hazard identification (HAZID) has been carried out. The scope of this HAZID is to identify the main risks which can occur during the bunkering from a LNG bunker vessel to a receiving vessel.

The safety analysis of the above mentioned content was performed at the premises of the Hamburg Port Authority in Hamburg, Germany. The aim was the identification of the main risks of LNG bunkering and their possible handling. The analysis is orientated on the Failure Mode and Effects Analysis (FMEA) method and the requirements given in IEC 60812. The analysis focussed on the identification of hazards caused by the LNG bunkering procedure.

It should be mentioned that without a LNG of NG leakage no additional risk for fire and explosion can occur. Therefore the aim is to prevent any leakages or to prepare the respective critical areas to be able to manage any leakage.

During the analysis 41 failures have been investigated. The analysis shows that five single point failures can lead to a critical situation. These failures are mainly related to big LNG leakages caused by e.g. collision or other reasons.

A number of recommendations for technical and procedural measures have been identified to prevent failures or reduce the effects of possible failures. These recommendations are listed in the documentation of the FMEA which is enclosed to this report.

For the limitations of the study compare section “Limitations” of this report.


Date 2012-01-06


2 Definition of project

Within the Clean North Sea Shipping (CNSS) project, founded by the EU in the Interreg IVB North Sea Region programme, in work package 4 – ‘Clean Shipping Technology’ there is an activity which is working on an LNG Showcase (Activity 2). The aim of this showcase is to provide recommendations, exchange experiences and discuss how to stimulate stakeholders like ports, terminal operators or shipping companies to use LNG and to start to create a market. In the action plan for this show case it was decided to work in Action C on a physical show case. As part of that it was decided to investigate the possible risks which may occur during LNG bunkering form a bunker vessel on a realistic example. Therefore a hazard identification (HAZID) has been carried out in this document to identify the main risks which can occur during the bunkering from a bunker vessel.

For the example of the LNG Show case it was decided to investigate the bunkering from the bunker vessel to the receiving vessel in the Port of Hamburg (Figure 1).

Figure 1 – Port of Hamburg (aerial view)

At least today there is no LNG infrastructure in the Port of Hamburg. Therefore it is required that LNG will be delivered to Hamburg. The most likely supply chain for the Port of Hamburg is shown in Figure 2. Firstly LNG will be transported to Hamburg form a large LNG Import terminal in Europe (e.g. Zeebrügge) or a small scale LNG production plant in Northern Europe by a LNG Feeder vessel. Because the distance to a LNG source is longer that practical it was assumed, that an intermediate LNG terminal will be constructed in Hamburg to store and redistribute LNG in the harbour. This intermediate terminal will be the basis for the LNG bunker vessel, which distributes the LNG to the respective receiving vessels. As today for traditional oil bunkering, it could be assumed, that a bunker vessel will normally only transport the ordered amount of fuel for one customer (delivery on demand).


Date 2012-01-06


LNG Feeder Vessel IntermediateTerminal

Bunker VesselTGE

Receiving VesselGL Feeder

Figure 2 - LNG supply chain for the example Port of Hamburg

For this hazard identification the bunkering from a LNG bunker vessel to a receiving container feeder vessel was investigated to identify all main risks which can occur during the bunkering of LNG in the harbour. As basis for the investigation a LNG bunker vessel design from TGE and a GL LNG container feeder vessel was chosen. Details of both vessels are described in Chapter 5.

The HAZID was carried out with the Failure Mode and Effects Analysis (FMEA) method. The method is described in Chapter 3.


Date 2012-01-06


3 Principle of the applied FMEA Method

The FMEA – Failure Mode and Effect Analysis is a systematic, semi quantitative risk analysis method for the identification of potential failures of technical systems and/or components, for the detection of failure consequences and for the classification of failures.

The overall aim of an FMEA is the detection of hidden failures and their prevention. The results of an FMEA can be used for quantitative analysis like fault tree analysis as input parameters.

The basic FMEA procedure involves the following steps:

• Define boundary conditions/assumptions for FMEA

• Decompose system into functional blocks

• Describe function and interfaces of each block (consider different operational modes)

• Functional narrative of component/block

• Definition of possible failures

• Identification of failure effects on the component and the system (local and end effect)

• Identification of failure cause

• Criticality Analysis:

o Consequence severity

o Occurrence probability of failure

o Probability of failure detection

• Provide recommendations for control measures and necessary actions

The procedure also integrates the assessment of the consequences from the identified failures. Therefore the procedure is strictly spoken a FMECA (Failure Mode Effect and Criticality Analysis).


Date 2012-01-06


The FMEA method is described by different technical standards. The most relevant standards are:

1. IEC Standard 60812 “Analysis Techniques for System Reliability – Procedure for Failure Mode and Effects Analysis”, second edition 2006

2. DIN 25448 “Ausfalleffektanalyse”,

3. US Military Standard MIL-STD-1629A “Procedures for Performing a Failure Mode and Effect Analysis”, (first description of FMEA method)

4. British Standard BS 5760

5. MoD Defence Standard 00-41 (focus on military equipment)

The FMEA which was accomplished in this document was orientated on the IEC Standard 60812. As defined in this standard, the single failure criterion is used. This means, that while considering one failure in a component, it is assumed that all other components work properly. Generally hidden failures are not considered. Hidden failures which may be caused by non identifiable malfunctions of a component are kept in consideration as far as possible. The used definitions are shown in Table 1.


Date 2012-01-06


Term Definition

Item Delimited part of the investigated system.

Failure Definition of the deviations of the component behaviour from its normality, including the description of the nature of the deviation.

Causes Definition of the triggering cause of the failure. For this the single failure presumption is used. However hidden failures are considered if they are not detectable and therefore can occur together with a single failure at any time.

Effect Definition of the consequence of a failure on the component, the system and the function of the system.

Control Definition of the detection options for a failure.

Action Descriptions of the essential measures for the prevention of a failure, including changes of the component and the system.

Occurrence

Severity

Detection

Qualitative assessment of the occurrence, severity and detection probability. The assessment carried out under the rating scales showed in Annex 7.

Comment Annotation to proposed changes of the system, to operation and to boundary conditions.

Table 1 – FMEA definitions

The function of the component was described at the beginning of the discussion and is listed in Annex 1. In Annex 7 the definitions for occurrence, severity and detection are displayed.

For this investigation a Functional FMEA was carried out. This is an approach where sub-assemblies are treated as “black boxes” providing required functions in the system. In this approach the analyst considers the effect of loss of inputs and internal failures of each “black box” on the required function of the system.

The assessment of occurrence, severity and detection was carried out, first without considering any safety measures and in a second revised step all existing safety measures were taken into account additionally.


Date 2012-01-06


4 Procedure for the Assessment of the FMEA results

Fundamental for the assessment of the different failure modes in the FMEA are the expected consequences as well as the probability of their occurrence.

For the assessment of the FMEA results a ranking of the detected failures is determined. For this several different evaluating procedures are available. Here, the assessment by means of a criticality matrix, as mentioned in the IEC 60812 is used. An example of a criticality matrix is shown in Figure 3. In this matrix the detected failures are shown in dependency to the severity and the probability of occurrence. In the matrix acceptable and unacceptable regions can be defined. It should be noted that there is no universal definition of criticality. The criticality needs to be defined by the analyst. The definitions differ widely between different branches.

1 2 3 4 5

1 Low Risk

2 Failure mode 2

3

4 Failure mode 1

5 High Risk

Probability of Occurence

Seve

rity

Figure 3 – Criticality matrix

In Figure 3 it is implied that the severity increases with the ascending order of numbers, where number 5 has the highest severity (fatalities and/or loss of system/other systems). It is also implied that likelihood of occurrence, on the Y-axis is also represented in ascending order.

The high risk region (red) is the intolerable region. Failures in this region can not be justified on any reasons. Failures in the “As Low As Reasonable Practical” (ALARP) region (yellow) the risk is only tolerable if risk reduction measures are impractical or if the costs are grossly disproportionate to the benefits gained. It has to be demonstrated, that all reasonable practical measures have been taken. Failures in the low risk area (green) have a negligible risk. It is no need for detailed work to demonstrate ALARP.

For a cross check the failures were listed according their risk priority number (RPN). The risk priority number is also a method for quantitative determination of criticality. Risk is here evaluated by a subjective measure of the severity of the effect and an estimate of the expected probability of its occurrence for a predetermined time period assumed for analysis. Additionally the level of failure detection at system level will be evaluated.


Date 2012-01-06


The so defined risk priority number (RPN) in a FMEA is expressed as follows:

RPN = S × P x D

where

S is a non-dimensional number that stands for severity, i.e. an estimate of how strongly the effects of the failure will affect the system or the user.

P is also a non-dimensional number that denotes probability of occurrence

D is a non-dimensional number that estimates the chance to identify the failure


Date 2012-01-06


5 Work principle of the bunkering between the bunker vessel and the receiving vessel

For this hazard identification the bunkering from a LNG bunker vessel to a receiving container feeder vessel was investigated to identify all main risks which can occur during the bunkering of LNG in the harbour.

As basis for the investigation a LNG bunker vessel design from TGE was chosen (Figure 4). The vessel is designed for the handling and transportation of LNG and marine gas oil (MGO). The purpose of the vessel is the use as a bunker supply vessel for LNG and MGO fuelled ships. The vessel is able to bunker the receiving vessel simultaneously with LNG and MGO.

Figure 4 – TGE bunker supply vessel (side view)

The principle dimensions of the vessel are given in the following:

Length overall 98.60 m Length b.p. 93.00 m Breath moulded 14.20 m Depth moulded 7.60 m Draugt (design) 4.20 m Deadweight 2050 t Cargo tank volume LNG (100%) 3000 m3 Cargo tank volume MGO (100%) 400 m3 The bunker vessel is equipped with a special transfer arm, comparable to a hard arm solution, carrying the piping and all relevant systems for the transfer of LNG and MGO. The transfer arm has an operating distance of 20 m and is supported within the ship structure between the LNG storage tanks. Movements of both ships during fuel transfer can be balanced by an automatic adjustment control system which equalizes all relative movements.

The bunker supply vessel will bunker a LNG fuelled container feeder. For the investigation of this study the design of the GL LNG container feeder was used (see Figure 5).


Date 2012-01-06


Figure 5 – Gas-fuelled feeder container vessel (side view)

The principle dimensions of the container feeder are given in the following:

Length overall 166.15 m Length b.p. 155.08 m Breath moulded 25.00 m Depth moulded 14.20 m Draugt (design) 9.50 m Deadweight 18300 t Capacity 1240 TEU Bunker tank volume LNG (100%) 670 m3 The bunker station on board of the receiving vessel was located beside the superstructure on the poop deck to ensure that the bunker station is not located in the cargo area and to have a short distance to the storage tank.

The bunkering was carried out at the container terminal Burchardkai in Hamburg, because it was intended for this investigation to use a berth with a lot of passing traffic. Furthermore the vessels which will enter the Parkhafen have to pass with higher speed to be still manoeuvrable. Therefore the berth Athabaskakai 8 was chosen (see Figure 6).


Date 2012-01-06


Figure 6 – Location of bunkering in the port of Hamburg (nautical chart)

The bunkering was carried out during normal loading and unloading of the vessel.

According to the aim of the analysis it was checked, where the main hazards can occur during LNG bunkering.


Date 2012-01-06


6 Participants

The following persons participated during the HAZID session from the 23rd to 24th of November 2011 at Hamburg Port Authority premises in Hamburg, Germany:

No. Company Name Role 23.11.2011 24.11.2011

1 Hamburg Port Authority Wolfgang Becker Enviromental and spatial planning temporary N

2 Hamburg Port Authority Hendrik Hollstein Enviromental and spatial planning temporary temporary3 Hamburg Port Authority Katja Leuteritz Trainee Y N4 Hartmann Reederei Meindert Bildhoff Gas carrier specialist Y Y5 HHLA Birgit Schwarz Terminal technoloy specialist Y N6 HHLA Peter Voltmann Specialist for operational sequences Y N7 Germanischer Lloyd Lars Langfeldt Project engineer Y Y8 Germanischer Lloyd Finn Vogler Senior project engineer Y Y

9 Meyer Werft Gerhard Untiedt Gas and machinery specialist Y N

10 Meyer Werft Johannes Beuse Gas engineering specialist Y Y

11 TGE Matrine Gas Engineering

Dr. Hans-Christian Haarmann-Kühn Gas engineering specialist Y Y

12 Unifeeder Egmont Piepiorka Operations Manager temporary N13 Harbour police Hamburg Lutz Dreyer Dangerous goods specialist Y Y

Table 2 – Participants (Y = present, N = not attending) All persons participated the whole time if not additionally mentioned.

7 Limitations

The analysis is based on following assumptions:

1. the study is limited to the bunkering of LNG from the bunker supply vessel to the container feeder at the berth Alabaskakai 8

2. the analysis focussed on the identification of the main hazards during LNG bunkering

3. the LNGPac is operating within its design limitations

4. attention was given to single point failure

5. regular inspection and maintenance is stipulated

6. the machine is operated by an experienced crew

7. the analysis was conducted based on technical information supplied by TGE and GL


Date 2012-01-06


8 Evaluated Operating Conditions

In general for a safety analysis different operation conditions were examined, to identify possible system weaknesses. For this analysis it was assumed during the FMEA that all critical failures will occur during normal operation (bunkering). The FMEA team concluded that during the start-up, shut-down procedure or ESD the risk is equal or lower to the risk during normal operation (bunkering).

Therefore only the following operational condition has been considered during the FMEA:

1. Normal operation (bunkering)

9 Evaluated Subsystems

For the HAZID the main areas which are affected by the bunkering at the berth have been identified. Grouped by these areas the HAZID was carried out. For the failures subject to this areas ranking of severity, occurrence and detection were done. Five categories have been defined for occurrences, for severity and for detection. The used definitions are given in the annex of this report.

The following areas were included in this procedure:

1. Terminal

2. Receiving vessel (Container Feeder)

3. Bunker equipment

4. Bunker operation

5. Bunker supply vessel

6. Waterway river Elbe


Date 2012-01-06


10 Assessment of the FMEA results

During the FMEA 41 failures have been investigated. The assessment of occurrence, severity and detection was carried out, in two steps: first without considering any safety measures (initial rating) and in a second revised step all existing safety measures, like monitoring, safety valves, alarm and shut-down systems, etc. were taken into account additionally (revised rating). Therefore Figure 7 shows distribution of the overall result in the criticality matrix for the initial rating and Figure 8 shows the criticality matrix including all safety measures.

1 2 3 4 5

1 1

2 2 1 6

3 4 4 1

4 1 7 3 2

5 6 2 1


Seve

rity

Figure 7 - Distribution of Failures (initial rating)

1 2 3 4 5

1 1 1 1

2 1 5 1 8

3 4 4 2 1

4 1 5 2

5 2 2


Seve

rity

Figure 8 - Distribution of Failures (revised rating)

In Figure 9 the distribution of the failures is shown according to their Risk Priority Number (RPN). On the x-axis the 30 failures with the highest RPN are shown and on the y-axis the RPN is given. The initial RPN is shown for


Date 2012-01-06


each failure in blue coloured bar (without considering any safety measure). The revised rating (considering all safety measures) is shown in green coloured bar beneath the bar for the initial rating to show the effect of the safety measures on the RPN. The difference of the blue and the green bar show clearly this effect. In failure cases with lower RPN numbers it can be shown, that safety measures not necessarily lead to a risk reduction. Nevertheless it is recommended to provide safety measures also for these cases.

Figure 9 – Effects ranked by RPN (initial: blue; revised: green)

List of effects corresponding to Figure 9:

1. RPNi = 50, RPNr = 10 - in case of overfilling, LNG may be pressed through the safety valves and vent lines to atmosphere, big gas cloud (Item: 4.2 - Overfilling)

2. RPNi = 40, RPNr = 15 - may lead to overfilling if bunker crew is not informed probably about status in tank (Item: 3.4.2 - Communication problems between vessels)

3. RPNi = 32, RPNr = 4 - if critical pressure is reached safety valves will open and gas will be vented to atmosphere (Item: 4.2 - Overpressure)

4. RPNi = 30, RPNr = 30 - Equipotential bonding not possible, sparks may be possible (but only in case of double failure, presence of gas, ignition possible) (Item: 3.26 - Equipotential bonding)


Date 2012-01-06


5. RPNi = 24, RPNr = 12 - loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection (Item: 5.2.21 - Loss of mooring)

6. RPNi = 24, RPNr = 12 - strong relative movements, loss of one mooring line, loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection it could be assumed, that the feeder vessel will lose the mooring to the berth prior to the loss of mooring between feeder and bunker barge. (Item: 6.1.14 - Surge from passing vessels)

7. RPNi = 20, RPNr = 20 - no effect, no reaction time for crew on bunker vessel and passing vessels, local traffic control may inform passing vessels prior to entering safety zone (Item: 6.1.2 - Vessel entering Safety Zone)

8. RPNi = 20, RPNr = 10 - lightning may ignite present gas clouds (Item: 4.1.1 - Lightning) 9. RPNi = 18, RPNr = 9 - LNG will evaporate direct after leakage, drip tray will protect ship structure (Item:

3.2.18 - Leakage of connection) 10. RPNi = 18, RPNr = 18 - LNG will evaporate direct after leakage (Item: 3.1.18 - Leakage of filling line) 11. RPNi = 18, RPNr = 18 - LNG will evaporate direct after leakage (Item: 3.1.18 - Leakage of filling line) 12. RPNi = 18, RPNr = 9 - parallel ESD of bunkering not possible (Item: 3.4.1 - Loss of ESD Connection) 13. RPNi = 16, RPNr = 16 - Big fallen objects may destroy piping on deck or the coverage of the tank

system, LNG leakage and big gas cloud, fire must be assumed on deck area and in the adjacent open spaces, a damage of storage tank of bunker vessel will not be expected. (Item: 5.1.9 - Big falling objects on the bunker vessel from terminal)

14. RPNi = 16, RPNr = 16 - person will fall in the water of lower vessel, one heavily injured or dead person (Item: 4.20 - Crew member falling over board)

15. RPNi = 16, RPNr = 16 - loss of proper mooring to berth, bigger relative movements to berth, master decision to stop bunkering (Item: 2.2.23 - Loss of mooring)

16. RPNi = 15, RPNr = 15 - Damage of outer shell and LNG storage tank of bunker vessel, LNG leakage and gas cloud, ignition assumed, big fire, low flame velocity, structural damage of ship structure according to leaking LNG, rapid phase transition could be expected. (Item: 6.1.1 - Collision)

17. RPNi = 15, RPNr = 15 - LNG spill, large gas cloud (Item: 3.2.12 - Loss of connection) 18. RPNi = 15, RPNr = 5 - icing around the hose, load of hoses will increase, if critical loads are reached,

emergency release of piping (Item: 4.15 - Loads due to snow and icing of the piping) 19. RPNi = 12, RPNr = 3 - only tension, buckling of hose, damage of hose can not be excluded, leakage

possible (Item: 3.1.10 - Excessive forces, stress on valves, hoses and pipes) 20. RPNi = 12, RPNr = 12 - hard arm stays in last position, if critical forces are reached connections

emergency release couplings will open, mechanical damages can not be excluded. According to black


Date 2012-01-06


out bunkering has stopped and all valves go to fail safe position, no LNG leakage possible (Item: 5.28 - Black-Out)

21. RPNi = 12, RPNr = 6 - hard arm, bunker manifold will be mechanically damaged, double walled piping connection will break first, leakage (Item: 3.1.10 – Excessive forces, stress on valves, hoses and pipes)

22. RPNi = 12, RPNr = 12 - fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel (Item: 2.1.2 - Fire - Explosion in machine spaces - LNG system of vessel)

23. RPNi = 12, RPNr = 12 - Vessel will approach with low speed, mechanical damage of the outer hull possible, damage of storage tank and gas system not expected (Item: 6.1.1 - Collision)

24. RPNi = 12, RPNr = 12 - fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, (Item: 5.1.2 - Fire - Explosion in machine spaces - LNG system of vessel)

25. RPNi = 12, RPNr = 12 - fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release (Item: 5.1.1 - Fire on Board)

26. RPNi = 12, RPNr = 12 - fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel. (Item: 2.1.1 - Fire on Board)

27. RPNi = 12, RPNr = 12 - bunker vessel will be heavily mechanically damaged, a damage of storage tank will not be assumed (no difference to normal operated vessel), possible break of mooring lines, bunker envelope will be left, Emergency shut down and disconnection of bunker line. (Item: 6.1.1 - Collision)

28. RPNi = 10, RPNr = 10 - passing traffic may be restricted according to the bunkering procedure (Item: 6.25 - restriction of shipping channel)

29. RPNi = 10, RPNr = 6 - flexible hose at the arm is of double walled design, rest of fixed piping is single walled, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded, (Item: 3.1.1 - Rupture of Filling Line)

30. RPNi = 10, RPNr = 6 - hose of composite design, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded, (Item: 3.1.1 - Rupture of Filling Line)


Date 2012-01-06


Furthermore Figure 10 and Figure 11 show the distribution of the failures according their severity ranking in the pie-charts. Figure 10 shows the initial rating (without any safety measures) and Figure 11 the revised version (consideration of all safety measures). The comparison of both charts clearly shows the positive effect of the safety measures. The effects of the failures could be significantly reduced by implementing the safety measures.

Hazardous effect; 9; 22%

No effect; 1; 2%

Minor effect; 9; 22%

Major effect; 13; 32%

Moderate effect; 9; 22%

Figure 10 - Distribution of Effects (initial rating)

Hazardous effect; 4; 10% No effect; 3; 7%

Minor effect; 15; 36%Major effect; 8; 20%

Moderate effect; 11; 27%

Figure 11 - Distribution of Effects (revised rating)


Date 2012-01-06


After entering all failures into the revised criticality matrix (consideration of all safety measures), it was judged were a failure or leakage will cause the most severe effect during the LNG bunkering. For verification these failures in the criticality matrix, they were cross checked against the failure list, where all failures were listed according their individual risk priority number from high to low numbers (high to low risk potential).

The analysis shows that the most critical situations could be expected in case of big LNG leakages. Furthermore it pointed out, that failures which lead to injury to persons are most critical. But the cases for injury of persons will not be different to conventional oil bunkering.

It pointed out, that 5 failure is in the high risk region of the criticality matrix, which displays an intolerable risk. These are related to the following failures:

1. Loss of bunker connection during bunkering (Item 3.2.12) resulting in a large LNG spill Mitigation measures: To avoid the probability of failures during connection a QC/DC should be considered. Furthermore the Emergency Shut-Down times should be minimised as far as possible to minimise the amount of leaking LNG.

2. Communication problems during the bunkering (Item: 3.4.2) may lead to critical situations (the severity of this failure is moderate, but the occurrence is very frequent; this failure is not different to the conventional bunkering) Mitigation measures: Bunker procedures and check lists should ensure sufficient communication.

3. Crew member is falling over board (Item: 4.20) (this failure is not different to the conventional bunkering) Mitigation measures: The bunker vessel must have a safe possibility for transfer of bunker crew to the receiving vessel.

4. Big falling objects from the terminal will hit the bunker vessel, damage of storage tank not expected but damage of bunker line possible (Item 5.1.9) Mitigation measures: To avoid the probability of failures during connection a QC/DC should be considered. Furthermore the Emergency Shut-Down times should be minimised as far as possible to minimise the amount of leaking LNG.


Date 2012-01-06


5. Side collision of passing vessel in bunker vessel (90° angle), damage of storage tank expected (Item: 6.1.1) Mitigation measures: The probability for a collision can be lowered by using defined areas for bunkering or traffic restrictions.


Date 2012-01-06


11 Recommendations

The analysis pointed out, that the most critical situations could be expected in case of large LNG leakages. The most critical case is a damage of the shell of the storage tank of the bunker vessel which can occur in case of collision.

During the FMEA several actions have been discussed to reduce the risk potential of the respective failures. In total 16 recommendations have been agreed on during the study. These recommendations are listed in the list of “Actions” enclosed to this report (Annex 5).

The ranking of occurrence, severity and detection in the FMEA assumes the “as is situation”. Observation of recommended actions and implementation of given additional control options will give the opportunity to re-evaluate these rankings by a follow up FMEA.

The main actions resulting from the analysis are given in chapter 12.1 and 12.2. Further actions are given in Annex 5.

11.1 Safety Related Actions

The following main safety related actions were discussed during the analysis:

1. Item 6.1.1, Side collision (90°) The probability for a collision can be lowered by using defined areas for bunkering or traffic restrictions. It should be considered, that this risk is no specific risk of the bunkering and bunker vessel, but similar to all gas fuelled vessel.

2. Item 6.1.14, Surge from passing traffic; Item 5.2.21, Loss of mooring Bunker Vessel: The manoeuvrability of the bunker vessel should ensure always a safe approach and departure to the receiving vessel under all foreseeable conditions.

3. Item 6.1.14, Surge from passing traffic; Item 5.2.21, Loss of mooring Bunker procedure: the bunker vessel should be moored with a sufficient number of mooring lines (compare e.g. Exxon mooring requirements). Mooring lines should be supplied by bunker vessel (regularly checked).

4. Item 3.2.12: Loss of bunker connection during bunkering To avoid the probability of failures during connection a QC/DC should be considered.


Date 2012-01-06


5. Item 4.20: Crew member falling overboard Bunker Procedure: the bunker vessel must have a safe possibility for transfer of people to the receiving vessel.

6. Item 1.17: Quay side safety zone during bunkering Bunker station design: the unused bunker station must be separated from the rest of the gas system (gas safe zone), otherwise the ex-zones will influence the terminal operation (according ex-zone no harbour operation in this area possible).

11.2 Non Safety Related Actions

During the analysis it pointed out, that no non safety related actions have to be carried out.


Date 2012-01-06


12 Used Documentation

The following documentation was used for the study:

1. Presentations

a. TGE, Dr. Hans-Christian Haarmann-Kühn: Technisches Konzept Bunkerschiff, Transfersystem, Bunkervorgang; 2011-11-23/24

2. Manuals / Reports

a. -

3. Diagrams / Lists

a. TGE: General Data Sheet 3000 m3 LNG Bunker supply vessel, RD0038, 2011-09-26

4. Drawings

a. TGE: General Arrangement Preliminary Layout 3000 m3 LNG Bunker supply vessel, RD0038 TH65 ADW 6501 0100, Rev. 2, 2011-09-26

b. Neptun Stahlkonstruktion:General Arrangement Plan CV Neptun 1200, 3104-0110-004-01-C, Rev. C

5. Literature

a. IEC Standard 60812 “Analysis techniques for system reliability – Procedure for failure mode and effect analysis (FMEA)” (CEI / IEC 60812: 2006-01)


Date 2012-01-06


13 FMEA Documentation

The following documentation of the FMEA is enclosed to this report:

1. List of “Function” evaluated

2. Summary of evaluated “Failures”

3. List of “Effects”

4. List of “Causes”

5. List of “Actions”

6. List of “Controls”

7. Definitions for Severity, Occurrence and Detection

8. FMEA Sheets


Date 2012-01-06


Annex

Report No. RD-ER 2011-131Date 2012-01-06

Germanischer Lloyd

Annex 1

List of evaluated “Functions“

Source: Germanischer Lloyd

Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG Bunkering

Functions

FunctionsCore Team:

GL Report Number: RD-ER 2011.31Prepared by: Finn VoglerFMEA Date (Orig.): 2011-11-23 - 2011-11-24FMEA Date (Rev.) -

Item # Item Name Function # Function

1.1.1 Fire on Terminal 1 Fire on Terminal

1.17 Difficult to arrange large safety zones on quay areas

1 A safety zone on the terminal will not be necessary if no crossover to the unused bunker station is existing and the bunker station can be defined as safe area.

2.1.1 Fire on Board 1 Fire on Board

2.1.2 Fire - Explosion in machine spaces - LNG system of vessel

1 Fire/Explosion on Board

2.1.8 Big falling objects on the receiving vessel from terminal

1 Falling Objects

2.16.24 Pressure release during loading and unloading

1 Pressure release during loading and unloading

2.2.23 Loss of mooring 1 Loss of mooring

3.1.1 Rupture of Filling Line 1 For bunker hose

3.1.1 Rupture of Filling Line 2 For hard arm

3.1.10 Excessive forces, stress on valves, hoses and pipes

1 For bunker hose


2 For hard arm

3.1.18 Leakage of filling line 1 For bunker hose

3.1.18 Leakage of filling line 2 For hard arm

3.2.11 Excessive forces, stress on valves, connections

1 Failure similar to Filling Line

3.2.12 Loss of connection 1 Loss of connection

3.2.18 Leakage of connection 1 Leakage of connection

3.26 Equipotential bonding 1 Equipotential bonding

3.3.1 Rupture of Vapour Return Line

1 For bunker hose


2 For hard arm



3.3.18 Leakage of vapour return line


3.4.1 Loss of ESD Connection 1 Loss of ESD Connection

3.4.2 Communication problems between vessels

1 Communication problems between vessels

4.1.1 Lightning 1 Lightning

4.1.2 Storm 1 Storm

4.1.27 Fog 1 Fog

4.1.7 High Waves - Relative Movements between the Vessels

1 high waves

Lutz Dreyer (WaPo HH), Dr. Haarmann-Kühn (TGE), Wolfgang Becker (HPA), Hendrik Hollstein (HPA), Katja Leuteritz (HPA), Gerhard Untiedt (MW), Johannes Beuse (MW), Meindert Bildhoff (Hartmann), Birgit Schwarz (HHLA), Peter Voltmann (HHLA), Egmont Piepiorka (Unifeeder), Lars Langfeldt (GL), Finn Vogler (GL)

File: FindingsHAZID4-1_Rev02.xls 1 / 2 Germanischer Lloyd SE


Functions

Item # Item Name Function # Function

4.13 Long shut-down times for ESD

1 Long shut-down times for ESD

4.15 Loads due to snow and icing of the piping

1 Loads due to snow and icing of the piping

4.19 Deviations from Bunker Procedures

1 see action

4.2 Overpressure 1 Overpressure

4.2 Overfilling 1 Overfilling

4.20 Crew member falling over board

1 Crew member falling over board

4.3 Emergency Release System activated

1 ESD activated

4.4 Lack of Training 1 see action

4.5 Unclear Responsibilities 1 Unclear Responsibilities

4.6 Regulation Gaps 1 Regulation Gaps

5.1.1 Fire on Board 1 Fire on Board

5.1.2 Fire - Explosion in machine spaces - LNG system of vessel

1 Fire/Explosion on Board

5.1.9 Big falling objects on the bunker vessel from terminal

1 Falling Objects

5.2.21 Loss of mooring 1 Loss of mooring

5.2.22 Release of mooring in wrong way

1 See failure 3 Collision

5.24 Pressure release during loading and unloading

1 Pressure release during loading and unloading

5.28 Black-Out 1 Hard arm

6.1.1 Collision 1 Collision

6.1.14 Surge from passing vessels

1 Surge of passing vessel

6.1.2 Vessel entering Safety Zone

1 Vessel entering Safety Zone

6.25 restriction of shipping channel

1 Restriction of shipping channel



Germanischer Lloyd

Annex 2

Summary of evaluated “Failures“



Failures (Summary)

Failures (Summary)Core Team:


Failure # Failure Item # Item Name Function1.1 Fire on Terminal 1.1.1 Fire on Terminal Fire on Terminal

1.1 see action 1.17 Difficult to arrange large safety zones on quay areas

A safety zone on the terminal will not be necessary if no crossover to the unused bunker station is existing and the bunker station can be defined as safe area.

1.1 Fire on the vessel 2.1.1 Fire on Board Fire on Board

1.1 Fire/Explosion in the machinery space of LNG system 2.1.2 Fire - Explosion in machine Fire/Explosion on Board1.1 Big falling objects on bunker vessel from terminal 2.1.8 Big falling objects on the

receiving vessel from terminalFalling Objects

1.1 unintended pressure release 2.16.24 Pressure release during loading and unloading

Pressure release during loading and unloading

1.1 Loss of one mooring line 2.2.23 Loss of mooring Loss of mooring

1.1 rupture of pipe 3.1.1 Rupture of Filling Line For bunker hose

2.1 rupture of pipe 3.1.1 Rupture of Filling Line For hard arm

1.1 Excessive forces 3.1.10 Excessive forces, stress on valves, hoses and pipes

For bunker hose

2.1 Excessive forces 3.1.10 Excessive forces, stress on valves, hoses and pipes

For hard arm

1.1 small leakage 3.1.18 Leakage of filling line For bunker hose

2.1 small leakage 3.1.18 Leakage of filling line For hard arm

1.1 unintended disconnection 3.2.12 Loss of connection Loss of connection

1.1 small leakage 3.2.18 Leakage of connection Leakage of connection

1.1 Loss of connection 3.26 Equipotential bonding Equipotential bonding

1.1 rupture of pipe 3.3.1 Rupture of Vapour Return Line For bunker hose

2.1 rupture of pipe 3.3.1 Rupture of Vapour Return Line For hard arm

1.1 Loss of ESD Connection 3.4.1 Loss of ESD Connection Loss of ESD Connection

1.1 Communication problems between vessels 3.4.2 Communication problems between vessels

Communication problems between vessels

1.1 Lightning's 4.1.1 Lightning Lightning

1.1 high wind velocities 4.1.2 Storm Storm

1.1 bad visibility 4.1.27 Fog Fog

1.1 high relative movements between vessels 4.1.7 High Waves - Relative Movements between the Vessels

high waves

1.1 Long shut down times (in case of leakage) 4.13 Long shut-down times for ESD Long shut-down times for ESD

1.1 Loads due to snow and icing of the piping 4.15 Loads due to snow and icing of the piping

Loads due to snow and icing of the piping

1.1 see action 4.19 Deviations from Bunker Procedures

see action

1.1 Over pressurization of storage tanks 4.2 Overpressure Overpressure

1.1 Overfilling of storage tanks 4.2 Overfilling Overfilling

1.1 Crew member falling over board 4.20 Crew member falling over board Crew member falling over board

1.1 Emergency Release System activated 4.3 Emergency Release System activated

ESD activated

1.1 see action 4.4 Lack of Training see action

1.1 see action 4.5 Unclear Responsibilities Unclear Responsibilities

1.1 see action 4.6 Regulation Gaps Regulation Gaps

1.1 Fire on the vessel 5.1.1 Fire on Board Fire on Board

1.1 Fire/Explosion in the machinery space of LNG system 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel

Fire/Explosion on Board

1.1 Big falling objects on bunker vessel from terminal 5.1.9 Big falling objects on the bunker vessel from terminal

Falling Objects

1.1 Loss of one mooring line 5.2.21 Loss of mooring Loss of mooring

1.1 unintended pressure release 5.24 Pressure release during loading and unloading


1.1 Black out of bunker vessel 5.28 Black-Out Hard arm

1.1 Passing vessel collides with ships during bunkering (fore/aft collision, side collision)

6.1.1 Collision Collision




Failures (Summary)

Failure # Failure Item # Item Name Function1.2 Passing vessel collides with bunker vessel from side (90°),

(only smaller vessel assumed (< 160 m), bigger vessel will not turn so quickly, most of the vessel will already supplied by a tug).

6.1.1 Collision Collision

1.3 Collision of bunker vessel during approach or leave 6.1.1 Collision Collision

1.1 Surge of passing vessel 6.1.14 Surge from passing vessels Surge of passing vessel

1.1 Vessel entering safety zone 6.1.2 Vessel entering Safety Zone Vessel entering Safety Zone

1.1 Restriction of shipping channel 6.25 restriction of shipping channel Restriction of shipping channel



Germanischer Lloyd

Annex 3

List of “Effects“



Effects

EffectsCore Team:


Effect Next Level Effect Revised Effect

1.1.1 LNG spill, large gas cloud

gas detection will detect leakage, ESD of bunkering

5 5 3.2.12 Loss of connection Loss of connection unintended disconnection

1.1.1 larger LNG leakage and big gas cloud, ignition possible

5 5 4.13 Long shut-down times for ESD

Long shut-down times for ESD

Long shut down times (in case of leakage)

1.1.1 location of vent exits in cargo area, big gas cloud assumed, gas cloud may be ignited

5 5 5.24 Pressure release during loading and unloading


unintended pressure release

1.1.1 Damage of outer shell and LNG storage tank of bunker vessel, LNG leakage and gas cloud, ignition assumed, big fire, low flame velocity, structural damage of ship structure according to leaking LNG, rapid phase transition could be

t d

5 5 6.1.1 Collision Collision Passing vessel collides with bunker vessel from side (90°),(only smaller vessel assumed (< 160 m), bigger vessel will not turn so quickly, most of the vessel will already supplied by a tug).

1.1.1 hose of composite design, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded,

hose will get small pinhole leakages before rupture, emergency shut down of bunker procedure.

5 3 3.1.1 Rupture of Filling Line

For bunker hose rupture of pipe

1.1.1 hose of composite design, big gas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloud can not be excluded

hose will get small pinhole leakages before rupture, emergency shut down of bunker procedure.

5 3 3.3.1 Rupture of Vapour Return Line

For bunker hose rupture of pipe

2.2.1 flexible hose at the arm is of double walled design, rest of fixed piping is single walled, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded,

According to the regular tests and qualification procedures of system a total rupture is not assumed

5 3 3.1.1 Rupture of Filling Line

For hard arm rupture of pipe

2.2.1 flexible hose at the arm is of double walled design, rest of fixed piping is single walled, big gas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloud can not be excluded,

According to the regular tests and qualification procedures of system a total rupture is not assumed

5 3 3.3.1 Rupture of Vapour Return Line

For hard arm rupture of pipe


Effect # Sev (Rev) Failure

Effects

Item Name FunctionItem #Sev (Init)



Effects

Effect Next Level Effect Revised EffectEffect # Sev

(Rev) Failure

Effects


1.1.1 in case of overfilling, LNG may be pressed through the safety valves and vent lines to atmosphere, big gas cloud

Tank condition is permanently monitored by bunker crew on receiving vessel. Pre alarm for overfilling at 95 %. Bunkering will be stopped automatically by two independent systems at 98,5 % and 99 % filling level (SIGTTO guideline).

5 2 4.2 Overfilling Overfilling Overfilling of storage tanks

1.1.1 location of vent exits above superstructure, gas cloud above vent exit, gas cloud could reach container bridge and may be ignited (double-failure, other safety systems act before safety valve, no difference to the vessel at normal operation)

4 4 2.16.24 Pressure release during loading and unloading



1.1.1 hard arm stays in last position, if critical forces are reached connections emergency release couplings will open, mechanical damages can not be excluded. According to black out bunkering has stopped and all valves go to fail safe position, no LNG leakage possible

4 4 5.28 Black-Out Hard arm Black out of bunker vessel

1.1.1 person will fall in the water of lower vessel, one heavily injured or dead person

4 4 4.20 Crew member falling over board

Crew member falling over board


1.1.1 fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release

sprinkler system for cooling of storage tanks and A60 insulation will protect LNG storage

4 4 5.1.1 Fire on Board Fire on Board Fire on the vessel

1.1.1 fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release,

sprinkler system for cooling of storage tanks and A60 insulation will protect LNG storage

4 4 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel


Fire/Explosion in the machinery space of LNG system

1.1.1 Big fallen objects may destroy piping on deck or the coverage of the tank system, LNG leakage and big gas cloud, fire must be assumed on deck area and in the adjacent open spaces, a damage of storage tank of bunker vessel will not b t d

Bunker ship will separated by fender system from the vessel (approximately 2 m)emergency shut down of bunkering, sprinkler system for storage tanks activated.Storage tank is protected by safety valves for the fire

4 4 5.1.9 Big falling objects on the bunker vessel from terminal

Falling Objects Big falling objects on bunker vessel from terminal



Effects


(Rev) Failure

Effects


1.1.1 fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel.

sprinkler system for cooling of storage tanks and A60 insulation will protect LNG storage on bunker vessel

4 4 2.1.1 Fire on Board Fire on Board Fire on the vessel

1.1.1 fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel

sprinkler system for cooling of storage tanks and A60 insulation will protect LNG storage on bunker vessel

4 4 2.1.2 Fire - Explosion in machine spaces - LNG system of vessel



1.1.1 may lead to overfilling if bunker crew is not informed probably about status in tank

Overfilling protection will close valves automatically.

4 3 3.4.2 Communication problems between vessels



1.1.1 lightning may ignite present gas clouds

During thunderstorm and lightning the bunkering is not allowed (e.g. port of Hamburg)

4 2 4.1.1 Lightning Lightning Lightning's

1.1.1 if critical pressure is reached safety valves will open and gas will be vented to atmosphere

pressure monitoring system will give alarm to operator, tank shut-down if critical limit is reached (prior to opening of safety valves)

4 2 4.2 Overpressure Overpressure Over pressurization of storage tanks

2.2.1 hard arm, bunker manifold will be mechanically damaged, double walled piping connection will break first, leakage

hard arm will actively follow the movements of the bunker connection, forces at the connection monitored, disconnection in case of to high forces.Emergency release coupling will disconnect if forces exceed critical limits.

4 2 3.1.10 Excessive forces, stress on valves, hoses and pipes

For hard arm Excessive forces

1.1.1 only tension, buckling of hose, damage of hose can not be excluded, leakage possible

hose support excludes high tension forces and buckling of hoesEmergency release coupling will disconnect if forces exceed critical limits.

4 1 3.1.10 Excessive forces, stress on valves, hoses and pipes

For bunker hose Excessive forces

1.1.1 LNG will evaporate direct after leakage

failure can be detected by visual inspection

3 3 3.1.18 Leakage of filling line For bunker hose small leakage

1.1.1 LNG will evaporate direct after leakage, drip tray will protect ship structure

failure will be detected by gas detection at bunker station

3 3 3.2.18 Leakage of connection

Leakage of connection

small leakage

1.1.1 parallel ESD of bunkering not possible

Bunkering procedure will be automatically stopped

3 3 3.4.1 Loss of ESD Connection

Loss of ESD Connection


1.1.1 Vessel will approach with low speed, mechanical damage of the outer hull possible, damage of storage tank and gas system not expected

vessel is designed for high manoeuvrability. Safety distances of storage tanks to outside are designed for small collisions

3 3 6.1.1 Collision Collision Collision of bunker vessel during approach or leave



Effects


(Rev) Failure

Effects


1.1.1 bunker vessel will be heavily mechanically damaged, a damage of storage tank will not be assumed (no difference to normal operated vessel), possible break of mooring lines, bunker envelope will be left, Emergency shut down and disconnection of bunker line.

3 3 6.1.1 Collision Collision Passing vessel collides with ships during bunkering (fore/aft collision, side collision)

2.2.1 LNG will evaporate direct after leakage

failure can be detected by visual inspection

3 3 3.1.18 Leakage of filling line For hard arm small leakage

1.1.1 loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection

According sufficient number of mooring lines the probability for overload is lower. A single loss of line should not influence the mooring.

3 2 5.2.21 Loss of mooring Loss of mooring Loss of one mooring line

1.1.1 strong relative movements, loss of one mooring line, loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection it could be assumed, that the feeder vessel will lose the mooring to the berth prior to the loss of mooring between feeder and bunker barge.

According sufficient number of mooring lines the probability for overload is lower. A single loss of line should not influence the mooring.

3 2 6.1.14 Surge from passing vessels

Surge of passing vessel


1.1.1 icing around the hose, load of hoses will increase, if critical loads are reached, emergency release of piping

Piping system is designed to handle ice loads on the piping.

3 1 4.15 Loads due to snow and icing of the piping



1.1.1 local fires expected, no direct influence on bunker procedure, affects on berthed ships is not expected

2 2 1.1.1 Fire on Terminal Fire on Terminal Fire on Terminal

1.1.1 passing traffic may be restricted according to the bunkering procedure

Traffic will be organized by local traffic control

2 2 6.25 restriction of shipping channel

Restriction of shipping channel


1.1.1 mooring lines make break, strong movements of vessel, operation cycle of bunkering may be left, emergency disconnection

During strong weather conditions the bunkering is not allowed (e.g. port of Hamburg)

2 2 4.1.2 Storm Storm high wind velocities

1.1.1 mooring lines make break, operation cycle of bunkering may be left, emergency disconnection

During strong weather conditions the bunkering is not allowed (e.g. port of Hamburg)

2 2 4.1.7 High Waves - Relative Movements between the Vessels

high waves high relative movements between vessels

1.1.1 according to the higher risk of collision, bunkering during bad visibility condition is more critical

According the visibility conditions the local traffic control will restrict the voyage of bunker vessel (e.g. port of Hamburg)

2 2 4.1.27 Fog Fog bad visibility



Effects


(Rev) Failure

Effects


1.1.1 during Emergency Release Disconnection approximately 1,5 l LNG will leak into the drip tray. hard arm or hose crane will go to safe position.

2 2 4.3 Emergency Release System activated

ESD activated Emergency Release System activated

1.1.1 no effect, no reaction time for crew on bunker vessel and passing vessels, local traffic control may inform passing vessels prior to entering safety zone

2 2 6.1.2 Vessel entering Safety Zone

Vessel entering Safety Zone

Vessel entering safety zone

1.1.1 Equipotential bonding not possible, sparks may be possible (but only in case of double failure, presence of gas, ignition possible)

2 2 3.26 Equipotential bonding

Equipotential bonding

Loss of connection

1.1.1 loss of proper mooring to berth, bigger relative movements to berth, master decision to stop bunkering

2 2 2.2.23 Loss of mooring Loss of mooring Loss of one mooring line

1.1.1 Big fallen objects may destroy components in the cargo area, gas system will not be affected

1 1 2.1.8 Big falling objects on the receiving vessel from terminal


1.1.1 see action 1.17 Difficult to arrange large safety zones on quay areas


see action

1.1.1 see action 4.5 Unclear Responsibilities

Unclear Responsibilities

see action

1.1.1 see action 4.6 Regulation Gaps Regulation Gaps see action

1.1.1 see action 4.4 Lack of Training see action see action

1.1.1 see action 4.19 Deviations from Bunker Procedures

see action see action



Germanischer Lloyd

Annex 4

List of “Causes“



Causes

CausesCore Team:


Cause # Cause Occ (Init)

Occ (Rev)

Det (Init)

Det (Rev)

Cause RPN

(Initial)

Cause RPN (Revised)

% Reduction in Cause

RPNItem # Item Name Function Failure Effect

1.1.1.1 see action 1,17 Difficult to arrange large safety zones on quay areas

A safety zone onthe terminal will not be necessary if no crossover to the unused bunker station is existing and the bunker station can be defined as safe area.


1.1.1.1 e.g. broken wire 5 5 3 3 30 30 0 3,26 Equipotential bonding

Equipotential bonding

Loss of connection

Equipotential bonding not possible, sparks may be possible (but only in case of double failure, presence of gas, ignition possible)

1.1.1.1 LNG leakage 2 2 1 1 10 10 0 4,13 Long shut-down times for ESD


Long shut down times (in case of leakage)

larger LNG leakage and big gas cloud, ignition possible

1.1.1.1 e.g. high humidity, spray from water curtain

5 5 1 1 15 5 66,67 4,15 Loads due to snow and icing of the piping



icing around the hose, load of hoses will increase,if critical loads are reached, emergency release of piping

1.1.1.1 see action 4,19 Deviations from Bunker Procedures

see action see action see action

1.1.1.1 e.g. loss of overpressure protection

4 2 2 1 32 4 87,5 4,2 Overpressure Overpressure Over pressurization of storage tanks

if critical pressure is reached safety valves will open and gas will be vented to atmosphere

1.1.1.1 e.g. loss of overfilling protection 5 5 2 1 50 10 80 4,2 Overfilling Overfilling Overfilling of storage tanks

in case of overfilling, LNG may be pressed through the safety valves and vent lines to atmosphere, big gas cloud

1.1.1.1 e.g. falling crew member 4 4 1 1 16 16 0 4,2 Crew member falling over board



person will fall in the water of lower vessel, one heavily injured or dead person

Lutz Dreyer (WaPo HH), Dr. Haarmann-Kühn (TGE), Wolfgang Becker (HPA), Hendrik Hollstein (HPA), Katja Leuteritz (HPA), Gerhard Untiedt (MW), Johannes Beuse (MW), Meindert Bildhoff (Hartmann), Birgit Schwarz (HHLA), Peter Voltmann (HHLA), Egmont Piepiorka (Unifeeder), Lars Langfeldt (GL), Finn Vogler (GL



Causes


Occ (Rev)

Det (Init)

Det (Rev)

Cause RPN

(Initial)

Cause RPN (Revised)



1.1.1.1 e.g. strong relative movements between vessel

3 3 1 1 6 6 0 4,3 Emergency Release System activated

ESD activated Emergency Release System activated

during Emergency Release Disconnection approximately 1,5 l LNG will leak into the drip tray. hard arm or hose crane will go to safe position.

1.1.1.1 see action 4,4 Lack of Training see action see action see action

1.1.1.1 see action 4,5 Unclear Responsibilities

Unclear Responsibilities


1.1.1.1 see action 4,6 Regulation Gaps Regulation Gaps see action see action

1.1.1.1 - mechanical damage of valve 2 2 1 1 10 10 0 5,24 Pressure release during loading and unloading



location of vent exits in cargo area, big gas cloud assumed, gas cloud may be ignited

1.1.1.1 e.g. short cut 3 3 1 1 12 12 0 5,28 Black-Out Hard arm Black out of bunker vessel

hard arm stays in last position, if critical forces are reached connections emergency release couplings will open, mechanical damages can notbe excluded. According to black out bunkering has stopped and all valves go to fail safe position,no LNG leakage possible

1.1.1.1 e.g. wide of vessel, additional safety distance

5 5 1 1 10 10 0 6,25 restriction of shipping channel



passing traffic may be restricted according to the bunkering procedure

1.1.1.1 e.g. burning van carrier 3 3 1 1 6 6 0 1.1.1 Fire on Terminal Fire on Terminal Fire on Terminal local fires expected, no direct influence on bunkerprocedure, affects on berthed ships is not expected

1.1.1.1 e.g. fire in accommodation 3 3 1 1 12 12 0 2.1.1 Fire on Board Fire on Board Fire on the vessel

fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel.

1.1.1.1 e.g. fire in accommodation 3 3 1 1 12 12 0 2.1.2 Fire - Explosion in machine spaces - LNG system of vessel



fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel

1.1.1.1 e.g. bottom of container will break, container will fall down

4 4 1 1 4 4 0 2.1.8 Big falling objects on the receiving vessel from terminal


Big fallen objects may destroy components in the cargo area, gas system will not be affected



Causes


Occ (Rev)

Det (Init)

Det (Rev)

Cause RPN

(Initial)

Cause RPN (Revised)



1.1.1.1 - safety valves will open e. g. in case of fire or overfilling, active safety systems will avoid opening of safety valves, safety valves are the last level of protection- mechanical damage of valve

2 2 1 1 8 8 0 2.16.24 Pressure release during loading and unloading



location of vent exits above superstructure, gas cloud above vent exit, gas cloud could reach container bridge and may be ignited (double-failure, other safety systems act before safety valve, no difference to the vessel at normal operation)

1.1.1.1 e.g. pre damaged mooring line 4 4 2 2 16 16 0 2.2.23 Loss of mooring Loss of mooring Loss of one mooring line

loss of proper mooring to berth, bigger relative movements to berth, master decision to stop bunkering

1.1.1.1 e.g. material failure 2 2 1 1 10 6 40 3.1.1 Rupture of Filling Line

For bunker hose rupture of pipe hose of composite design, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded,

1.1.1.1 e.g. material failure 2 2 1 1 10 6 40 3.1.1 Rupture of Filling Line

For hard arm rupture of pipe flexible hose at the arm is of double walled design, rest of fixed piping is single walled, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded

1.1.1.1 e.g. relative movements between vessel

3 3 1 1 12 3 75 3.1.10 Excessive forces, stress on valves, hoses and pipes

For bunker hose Excessive forces

only tension, buckling of hose, damage of hose can not be excluded, leakage possible


3 3 1 1 12 6 50 3.1.10 Excessive forces, stress on valves, hoses and pipes

For hard arm Excessive forces

hard arm, bunker manifold will be mechanically damaged, double walled piping connection will break first, leakage

1.1.1.1 e.g. untight gasket 3 3 2 2 18 18 0 3.1.18 Leakage of filling line

For bunker hose small leakage LNG will evaporate direct after leakage

1.1.1.1 e.g. untight gasket 3 3 2 2 18 18 0 3.1.18 Leakage of filling line

For hard arm small leakage LNG will evaporate direct after leakage

1.1.1.1 e.g. ERC will not be activated 3 3 1 1 15 15 0 3.2.12 Loss of connection

Loss of connection

unintended disconnection

LNG spill, large gas cloud

1.1.1.1 e.g. untight gasket 3 3 2 1 18 9 50 3.2.18 Leakage of connection

Leakage of connection

small leakage LNG will evaporate direct after leakage, drip tray will protect ship structure

1.1.1.1 e.g. material failure 2 2 1 1 10 6 40 3.3.1 Rupture of Vapour Return Line

For bunker hose rupture of pipe hose of composite design, big gas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloud can not be excluded

1.1.1.1 e.g. material failure 2 2 1 1 10 6 40 3.3.1 Rupture of Vapour Return Line

For hard arm rupture of pipe flexible hose at the arm is of double walled design, rest of fixed piping is single walled, big gas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloud can not be excluded,



Causes


Occ (Rev)

Det (Init)

Det (Rev)

Cause RPN

(Initial)

Cause RPN (Revised)



1.1.1.1 e.g. broken wire 3 3 2 1 18 9 50 3.4.1 Loss of ESD Connection



parallel ESD of bunkering not possible

1.1.1.1 e.g. loss of VHF 5 5 2 1 40 15 62,5 3.4.2 Communication problems between vessels



may lead to overfilling if bunker crew is not informed probably about status in tank

1.1.1.1 weather conditions 5 5 1 1 20 10 50 4.1.1 Lightning Lightning Lightning's lightning may ignite present gas clouds1.1.1.1 weather conditions 5 5 1 1 10 10 0 4.1.2 Storm Storm high wind

velocitiesmooring lines make break, strong movements of vessel, operation cycle of bunkering may be left, emergency disconnection

1.1.1.1 weather conditions 5 5 1 1 10 10 0 4.1.27 Fog Fog bad visibility according to the higher risk of collision, bunkering during bad visibility condition is more critical

1.1.1.1 weather conditions 5 5 1 1 10 10 0 4.1.7 High Waves - Relative Movements between the Vessels

high waves high relative movements between vessels

mooring lines make break, operation cycle of bunkering may be left, emergency disconnection

1.1.1.1 e.g. fire in accommodation 3 3 1 1 12 12 0 5.1.1 Fire on Board Fire on Board Fire on the vessel

fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release

1.1.1.1 e.g. fire in accommodation 3 3 1 1 12 12 0 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel



fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release,


4 4 1 1 16 16 0 5.1.9 Big falling objects on the bunker vessel from terminal


Big fallen objects may destroy piping on deck or the coverage of the tank system, LNG leakage and big gas cloud, fire must be assumed on deck area and in the adjacent open spaces, a damage of storage tank of bunker vessel will not be expected

1.2.1.1 e.g. pre damaged mooring line 4 3 2 2 24 12 50 5.2.21 Loss of mooring Loss of mooring Loss of one mooring line

loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection

1.3.1.1 failure of passing vessel 4 4 1 1 12 12 0 6.1.1 Collision Collision Passing vessel collides with ships during bunkering (fore/aft collision, side collision)

bunker vessel will be heavily mechanically damaged, a damage of storage tank will not be assumed (no difference to normal operated vessel), possible break of mooring lines, bunker envelope will be left, Emergency shut down and disconnection of bunker line.



Causes


Occ (Rev)

Det (Init)

Det (Rev)

Cause RPN

(Initial)

Cause RPN (Revised)



2.1.1.1 e.g. black out of passing vessel, loss of steering machinery

3 3 1 1 15 15 0 6.1.1 Collision Collision Passing vessel collides with bunker vessel from side (90°),(only smaller vessel assumed (< 160 m), bigger vessel will not turn so quickly, most of the vessel will already supplied by a tug).

Damage of outer shell and LNG storage tank of bunker vessel, LNG leakage and gas cloud, ignition assumed, big fire, low flame velocity, structural damage of ship structure according to leaking LNG, rapid phase transition could be expected.

2.1.1.1 operator failure 4 4 1 1 12 12 0 6.1.1 Collision Collision Collision of bunker vessel during approach or leave

Vessel will approach with low speed, mechanical damage of the outer hull possible, damage of storage tank and gas system not expected

2.1.1.1 e.g. pre damaged mooring line 4 3 2 2 24 12 50 6.1.14 Surge from passing vessels



strong relative movements, loss of one mooring line, loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection it could be assumed, that the feeder vessel will lose the mooring to the berth prior to the loss of mooring between feeder and bunker barge.

2.1.1.1 e.g. wrong master decision 5 5 2 2 20 20 0 6.1.2 Vessel entering Safety Zone

Vessel entering Safety Zone

Vessel entering safety zone

no effect, no reaction time for crew on bunker vessel and passing vessels, local traffic control may inform passing vessels prior to entering safety zone



Germanischer Lloyd

Annex 5

List of “Actions“



Actions (Summary)

Actions (Summary)Core Team:


Action # Action Item # Item Name Cause # CauseCause RPN

(Initial)

Cause RPN (Revised)

1 For the size off possible gas clouds the SIGTTO study should be checked


1.1.1.1 - safety valves will open e. g. in case of fire or overfilling, active safety systems will avoid opening of safety valves, safety valves are the last level of protection�- mechanical damage of valve�

8 8

1 For the size off possible gas clouds the SIGTTO study should be checked


1.1.1.1 - mechanical damage of valve�

10 10

2 Terminal: a gas detection system on the container bridge should be discussed/recommended (alarm, ESD).



8 8

2 Terminal: a gas detection system on the container bridge should be discussed/recommended (alarm ESD)



10 10

3 To avoid the probability of failures during connection a QCDC should be considered.

3.2.12 Loss of connection 1.1.1.1 e.g. ERC will not be activated

15 15

4 Bunker station design: the unused bunker station must be separated from the rest of the gas system (gas safe zone), otherwise the ex-zones will influence the terminal operation (according ex-zone no harbour operation in this area possible).


1.1.1.1 see action

5 Operational Manual: the terminal should be informed, if LNG bunker operations are planned during loading and unloading.



8 8

5 Operational Manual: the terminal should be informed, if LNG bunker operations are planned during loading and unloading



10 10




Actions (Summary)


(Initial)

Cause RPN (Revised)

6 Operational Manual: the local traffic control should be informed about the planned bunkering.

6.25 restriction of shipping channel

1.1.1.1 e.g. wide of vessel, additional safety distance

10 10

7 Bunker Standard: a major incident, e.g. big release of gas, should be communicated to the port authority.



8 8

7 Bunker Standard: a major incident, e.g. big release of gas, should be communicated to the port authority.



10 10

8 Hard Arm Design: a second energy source for the hard arm should be considered (emergency switchboard)

5.28 Black-Out 1.1.1.1 e.g. short cut 12 12

9 Design: pressure surge for shut down scenario must be calculated and shut down times shall be optimized accordingly.


1.1.1.1 LNG leakage 10 10

10 Bunker Procedure: The responsibilities have to be clearly defined in the bunker check lists prior to bunkering.

4.5 Unclear Responsibilities 1.1.1.1 see action

11 Legislation: the bunkering must be clearly regulated.

4.6 Regulation Gaps 1.1.1.1 see action

12 Rules - STCW: training of crew should be clearly defined.

4.4 Lack of Training 1.1.1.1 see action

12 Rules - STCW: training of crew should be clearly defined.


1.1.1.1 see action

13 Bunker Procedure: the bunker vessel must have a safe possibility for transfer of people to the receiving vessel.


1.1.1.1 e.g. falling crew member 16 16

14 Bunker procedure: the bunker vessel should be moored with a sufficient number of mooring lines (comp. and Exxon mooring requirements).Mooring lines should be supplied by bunker vessel (regularly checked).

5.2.21 Loss of mooring 1.1.1.1 e.g. pre damaged mooring line

24 12

14 Bunker procedure: the bunker vessel should be moored with a sufficient number of mooring lines (comp. and Exxon mooring requirements).Mooring lines should be supplied by bunker vessel (regularly checked).


1.1.1.1 e.g. pre damaged mooring line

24 12

15 Bunker Vessel: The manoeuvrability of the bunker vessel should ensure always a safe approach and departure to the receiving vessel under all foreseeable conditions.

5.2.21 Loss of mooring 1.1.1.1 e.g. pre damaged mooring line

24 12



Actions (Summary)


(Initial)

Cause RPN (Revised)

15 Bunker Vessel: The manoeuvrability of the bunker vessel should ensure always a safe approach and departure to the receiving vessel under all foreseeable conditions.


1.1.1.1 e.g. pre damaged mooring line

24 12

16 The probability for a collision can be lowered by using defined areas for bunkering or traffic restrictions.It should be considered, that this risk is no specific risk of the bunkering and bunker vessel, but similar to all gas fuelled vessel

6.1.1 Collision 1.2.1.1 e.g. black out of passing vessel, loss of steering machinery

15 15



Germanischer Lloyd

Annex 6

List of „Controls“



Controls

ControlsCore Team:


Control # Control Control Type Item # Item Name Cause # Cause

1 regular tightness test Detection 3.1.1 Rupture of Filling Line 2.1.1.1 e.g. material failure

2 visual inspection Detection 3.1.1 Rupture of Filling Line 2.1.1.1 e.g. material failure

3 regular inspection of piping system Detection 3.1.1 Rupture of Filling Line 2.1.1.1 e.g. material failure

4 regular tightness test Detection 3.1.1 Rupture of Filling Line 1.1.1.1 e.g. material failure

5 visual inspection Detection 3.1.1 Rupture of Filling Line 1.1.1.1 e.g. material failure

6 regular inspection of piping system Detection 3.1.1 Rupture of Filling Line 1.1.1.1 e.g. material failure

7 max. hose movements considered during design

Prevention 3.1.10 Excessive forces, stress on valves, hoses and pipes


8 Force control on bunker connection Detection 3.1.10 Excessive forces, stress on valves, hoses and pipes


9 max. hose movements considered during design

Prevention 3.1.10 Excessive forces, stress on valves, hoses and pipes


10 Force control on bunker connection Detection 3.1.10 Excessive forces, stress on valves, hoses and pipes


11 visual inspection Detection 3.1.18 Leakage of filling line 1.1.1.1 e.g. untight gasket

12 tightness test before each bunkering Detection 3.1.18 Leakage of filling line 1.1.1.1 e.g. untight gasket

13 visual inspection Detection 3.1.18 Leakage of filling line 2.1.1.1 e.g. untight gasket

14 tightness test before each bunkering Detection 3.1.18 Leakage of filling line 2.1.1.1 e.g. untight gasket

15 regular tightness test Detection 3.3.1 Rupture of Vapour Return Line

2.1.1.1 e.g. material failure

16 visual inspection Detection 3.3.1 Rupture of Vapour Return Line


17 regular inspection of piping system Detection 3.3.1 Rupture of Vapour Return Line


18 regular tightness test Detection 3.3.1 Rupture of Vapour Return Line


19 visual inspection Detection 3.3.1 Rupture of Vapour Return Line


20 regular inspection of piping system Detection 3.3.1 Rupture of Vapour Return Line


21 Emergency release coupling Prevention 3.1.10 Excessive forces, stress on valves, hoses and pipes


22 Emergency release coupling Prevention 3.1.10 Excessive forces, stress on valves, hoses and pipes


23 gas detection system Detection 3.2.12 Loss of connection 1.1.1.1 e.g. ERC will not be activated

24 visual inspection Detection 3.2.18 Leakage of connection 1.1.1.1 e.g. untight gasket25 tightness test before each bunkering Detection 3.2.18 Leakage of connection 1.1.1.1 e.g. untight gasket26 gas detection system Detection 3.2.18 Leakage of connection 1.1.1.1 e.g. untight gasket27 Signal monitoring Detection 3.4.1 Loss of ESD Connection 1.1.1.1 e.g. broken wire28 Vetting list Prevention 3.4.2 Communication problems

between vessels1.1.1.1 e.g. loss of VHF

29 Overfilling protection Detection 3.4.2 Communication problems between vessels

1.1.1.1 e.g. loss of VHF

30 Bunker procedure: bunkering during heavy weather conditions (thunderstorm, waves, wind) should be forbidden

Prevention 4.1.1 Lightning 1.1.1.1 weather conditions


Prevention 4.1.2 Storm 1.1.1.1 weather conditions


Prevention 4.1.7 High Waves - Relative Movements between the Vessels

1.1.1.1 weather conditions

33 SeeSchStrO, Announcement to harbour traffic regulation (HVO), will restrict traffic during bad visibility conditions.

Prevention 4.1.27 Fog 1.1.1.1 weather conditions

34 Emergency disconnection if operation cycle is left

Prevention 4.1.7 High Waves - Relative Movements between the Vessels

1.1.1.1 weather conditions




Controls

Control # Control Control Type Item # Item Name Cause # Cause


Prevention 4.1.2 Storm 1.1.1.1 weather conditions

36 Visible inspection Detection 4.2 Overpressure 1.1.1.1 e.g. loss of overpressure protection

38 Visible inspection Detection 4.2 Overfilling 1.1.1.1 e.g. loss of overfilling protection

39 Redundant overfilling protection Prevention 4.2 Overfilling 1.1.1.1 e.g. loss of overfilling protection

40 Pressure monitoring system of storage tanks Detection 4.2 Overpressure 1.1.1.1 e.g. loss of overpressure protection

41 gas detection system Detection 4.13 Long shut-down times for ESD

1.1.1.1 LNG leakage

42 piping is designed to handle ice loads Prevention 4.15 Loads due to snow and icing of the piping

1.1.1.1 e.g. high humidity, spray from water curtain

43 Water sprinkler system for cooling of tanks Prevention 5.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

44 A60 insulation to storage tanks Prevention 5.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

45 fire detection system Detection 5.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

46 Water sprinkler system for cooling of tanks Prevention 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel

1.1.1.1 e.g. fire in accommodation

47 A60 insulation to storage tanks Prevention 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel


48 fire detection system Detection 5.1.2 Fire - Explosion in machine spaces - LNG system of vessel


49 Water sprinkler system for cooling of tanks Prevention 5.1.9 Big falling objects on the bunker vessel from terminal


50 Safety valves storage tank Prevention 5.1.9 Big falling objects on the bunker vessel from terminal


53 Water sprinkler system for cooling of tanks Prevention 2.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

54 A60 insulation to storage tanks Prevention 2.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

55 fire detection system Detection 2.1.1 Fire on Board 1.1.1.1 e.g. fire in accommodation

56 Water sprinkler system for cooling of tanks Prevention 2.1.2 Fire - Explosion in machine spaces - LNG system of vessel


57 A60 insulation to storage tanks Prevention 2.1.2 Fire - Explosion in machine spaces - LNG system of vessel


58 fire detection system Detection 2.1.2 Fire - Explosion in machine spaces - LNG system of vessel




Germanischer Lloyd

Annex 7

Definitions for Severity, Occurrence and Detection



Rating Criteria

Severity Rating Scale Occurrence Rating Scale# Description Criteria # Description Criteria

1 No effect The failure does not affect the normal operation of the system. 1 At no time Not possible: if a disturbance can not occur because of physical causes.

2 Minor effect No breakdown and disturbed operation of the system with the possibility of further operation. 2 Very rare

Technical excluded: if a disturbance can only occur with appearance of a minimum of two failures. (characteristic experience: once in 100 years of operation)

3 Moderate effect Damage and/or breakdown of the system, repair required, no damage of other system components. 3 Rare

Not probable: under the assumption that the disturbance will not occur during the lifetime of the component. (characteristic experiences: once in 10 to 100 years of operation)

4 Major effect Injured people and/or major damage/loss of the system/other systems. 4 Sometimes

Low probability: under the assumption that the disturbance will occur during the lifetime of the component. (characteristic experience: once in 1 to 10 years of operation)

5 Hazardous effect Fatalities and/or loss of the system as well as damage/loss of other systems. 5 Frequently

Probable: under the assumption that the disturbance will occur once or several times during one year of operation. (characteristic experience: more than once a year of operation)

Detection Rating Scale# Description Criteria

1 Ever The disturbance will cause an alert, will initiate a shutoff or will lead to damages.

2 Often The disturbance is detectable according to deviations of process parameters. (e.g. increase of temperature)

3 UnlikelyThe disturbance is detectable in principle. But currently there is no possibility to detect the disturbance. (e.g. corresponding sensor not present)

4 Very unlikely It is possible to detect the disturbance physically. But it will not be assumed that the disturbance will be detected.

5 Never Physically it is not possible to detect the disturbance.



Germanischer Lloyd

Annex 8

FMEA Sheets



FMEA - Terminal - Berth

FMEA - Terminal - BerthCore Team:


Sev

Occ Det

RPN

1 Terminal - Berth (Alabasterkai8)

1.1 External Influences1.1.1 Fire on Terminal Fire on Terminal 1 Fire on Terminal local fires expected, no direct

influence on bunker procedure, affects on berthed ships is not expected

2 e.g. burning van carrier 3 1 6 2 3 1 6



1 see action see action see action 11 - 4 Bunker station design: the unused bunker station must be separated from the rest of the gas system (gas safe zone), otherwise the ex-zoneswill influence the terminal operation (according ex-zone no harbour operation in this area possible).

Revised


Effect# Det # #Control TypeControl Action# Failure Revised EffectItem Name Sev

Occ

RPNFunction Cause


Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG BunkeringFMEA - Receiving Vessel

FMEA - Receiving VesselCore Team:


Sev

Occ Det

RPN

2 Receiving Vessel2.1 External Influences

2.1.1 Fire on Board Fire on Board 1 Fire on the vessel fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel.

4 e.g. fire in accommodation 3 1 12 53 Water sprinkler system for cooling of tanks

Prevention sprinkler system for cooling ofstorage tanks and A60 insulation will protect LNG storage on bunker vessel

4 3 1 12

54 A60 insulation to storage tanks

Prevention

55 fire detection system Detection2.1.2 Fire - Explosion in machine

spaces - LNG system of vessel

Fire/Explosion on Board 1 Fire/Explosion in the machinery space of LNG system

fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release, bunker vessel will leave receiving vessel


Prevention sprinkler system for cooling ofstorage tanks and A60 insulation will protect LNG storage on bunker vessel

4 3 1 12


Prevention

58 fire detection system Detection2.1.8 Big falling objects on the

receiving vessel from terminalFalling Objects 1 Big falling objects on bunker

vessel from terminalBig fallen objects may destroycomponents in the cargo area, gas system will not be affected

1 e.g. bottom of container will break, container will fall down

4 1 4 1 4 1 4

2.2 Mooring2.2.23 Loss of mooring Loss of mooring 1 Loss of one mooring line loss of proper mooring to

berth, bigger relative movements to berth, master decision to stop bunkering

2 e.g. pre damaged mooring line

4 2 16 2 4 2 16

2.16 Parallel loading and unloading of the vessel



1 unintended pressure release location of vent exits above superstructure, gas cloud above vent exit, gas cloud could reach container bridge and may be ignited (double-failure, other safety systems act before safety valve, no difference to the vessel at normal operation)

4 - safety valves will open e. g. in case of fire or overfilling, active safety systems will avoid opening of safety valves, safety valves are the last level of protection- mechanical damage of valve

2 1 8 4 2 1 8 11 - 1 For the size off possible gas clouds the SIGTTO study should be checked

Revised



Occ

RPNFunction Cause


Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG BunkeringFMEA - Receiving Vessel

Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

11 - 2 Terminal: a gas detection system on the container bridge should be discussed/recommended (alarm, ESD).

11 - 5 Operational Manual: the terminal should be informed, if LNG bunker operations are planned during loading and unloading.

11 - 7 Bunker Standard: a major incident, e.g. big release of gas, should be communicated to the port authority.


Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG BunkeringFMEA - Bunkering Interface

FMEA - Bunkering InterfaceCore Team:


Sev

Occ Det

RPN

3 Bunkering Interface3.1 Filling Line

3.1.1 Rupture of Filling Line For bunker hose 1 rupture of pipe hose of composite design, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded,

5 e.g. material failure 2 1 10 4 regular tightness test Detection hose will get small pinhole leakages before rupture, emergency shut down of bunker procedure.

3 2 1 6

5 visual inspection Detection6 regular inspection of piping

systemDetection

For hard arm 1 rupture of pipe flexible hose at the arm is of double walled design, rest of fixed piping is single walled, LNG spill on receiving and bunker vessel, big gas cloud, gas alarm, ESD initiated, bunkering stopped, structural damage of the vessels could not be excluded, ignition of gas cloud can not be excluded,

5 e.g. material failure 2 1 10 1 regular tightness test Detection According to the regular tests and qualification procedures of system a total rupture is notassumed

3 2 1 6


systemDetection


For bunker hose 1 Excessive forces only tension, buckling of hose, damage of hose can not be excluded, leakage possible

4 e.g. relative movements between vessel

3 1 12 7 max. hose movements considered during design

Prevention hose support excludes high tension forces and buckling ofhoesEmergency release coupling will disconnect if forces exceed critical limits.

1 3 1 3

8 Force control on bunker connection

Detection

21 Emergency release coupling Prevention

Revised



Occ

RPNFunction Cause



Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

For hard arm 1 Excessive forces hard arm, bunker manifold willbe mechanically damaged, double walled piping connection will break first, leakage

4 e.g. relative movements between vessel

3 1 12 9 max. hose movements considered during design

Prevention hard arm will actively follow the movements of the bunker connection, forces at the connection monitored, disconnection in case of to high forces.Emergency release coupling will disconnect if forces exceed critical limits.

2 3 1 6

10 Force control on bunker connection

Detection

22 Emergency release coupling Prevention

3.1.18 Leakage of filling line For bunker hose 1 small leakage LNG will evaporate direct afterleakage

3 e.g. untight gasket 3 2 18 11 visual inspection Detection failure can be detected by visual inspection

3 3 2 18

12 tightness test before each bunkering

Detection

For hard arm 1 small leakage LNG will evaporate direct afterleakage

3 e.g. untight gasket 3 2 18 13 visual inspection Detection failure can be detected by visual inspection

3 3 2 18


Detection

3.2 Bunker Connection3.2.11 Excessive forces, stress on

valves, connectionsFailure similar to Filling Line

3.2.12 Loss of connection Loss of connection 1 unintended disconnection LNG spill, large gas cloud 5 e.g. ERC will not be activated 3 1 15 23 gas detection system Detection gas detection will detect leakage, ESD of bunkering

5 3 1 15 11 - 3 To avoid the probability of failures during connection a QCDC should be considered.

3.2.18 Leakage of connection Leakage of connection 1 small leakage LNG will evaporate direct afterleakage, drip tray will protect ship structure

3 e.g. untight gasket 3 2 18 24 visual inspection Detection failure will be detected by gas detection at bunker station

3 3 1 9


Detection

26 gas detection system Detection3.3 Vapour Return Line


For bunker hose 1 rupture of pipe hose of composite design, biggas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloud can not be excluded

5 e.g. material failure 2 1 10 18 regular tightness test Detection hose will get small pinhole leakages before rupture, emergency shut down of bunker procedure.

3 2 1 6


systemDetection

For hard arm 1 rupture of pipe flexible hose at the arm is of double walled design, rest of fixed piping is single walled, big gas cloud, gas alarm, ESD initiated, bunkering stopped, ignition of gas cloudcan not be excluded,

5 e.g. material failure 2 1 10 15 regular tightness test Detection According to the regular tests and qualification procedures of system a total rupture is notassumed

3 2 1 6


systemDetection


Failure similar to Filling Line

3.3.18 Leakage of vapour return line Failure similar to Filling Line

3.4 Communication Interface3.4.1 Loss of ESD Connection Loss of ESD Connection 1 Loss of ESD Connection parallel ESD of bunkering not

possible3 e.g. broken wire 3 2 18 27 Signal monitoring Detection Bunkering procedure will be

automatically stopped3 3 1 9

3.4.2 Communication problems between vessels


1 Communication problems between vessels

may lead to overfilling if bunker crew is not informed probably about status in tank

4 e.g. loss of VHF 5 2 40 28 Vetting list Prevention Overfilling protection will closevalves automatically.

3 5 1 15



Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

29 Overfilling protection Detection3.26 Equipotential bonding Equipotential bonding 1 Loss of connection Equipotential bonding not

possible, sparks may be possible (but only in case of double failure, presence of gas, ignition possible)

2 e.g. broken wire 5 3 30 2 5 3 30


Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG BunkeringFMEA - Bunker Operation

FMEA - Bunker OperationCore Team:


Sev

Occ Det

RPN

4 Bunker Operation4.1 External Influences

4.1.1 Lightning Lightning 1 Lightning's lightning may ignite present gas clouds

4 weather conditions 5 1 20 30 Bunker procedure: bunkering during heavy weather conditions (thunderstorm, waves, wind) should be forbidden

Prevention During thunderstorm and lightning the bunkering is not allowed (e.g. port of Hamburg)

2 5 1 10

4.1.2 Storm Storm 1 high wind velocities mooring lines make break, strong movements of vessel, operation cycle of bunkering may be left, emergency disconnection


Prevention During strong weather conditions the bunkering is not allowed (e.g. port of Hamburg)

2 5 1 10


Prevention

4.1.7 High Waves - Relative Movements between the Vessels

high waves 1 high relative movements between vessels

mooring lines make break, operation cycle of bunkering may be left, emergency disconnection


Prevention During strong weather conditions the bunkering is not allowed (e.g. port of Hamburg)

2 5 1 10


Prevention

4.1.27 Fog Fog 1 bad visibility according to the higher risk of collision, bunkering during bad visibility condition is more critical

2 weather conditions 5 1 10 33 SeeSchStrO, Announcement to harbour traffic regulation (HVO), will restrict traffic during bad visibility conditions.

Prevention According the visibility conditions the local traffic control will restrict the voyage of bunker vessel (e.g. port of Hamburg)

2 5 1 10

4.2 Overpressure Overpressure 1 Over pressurization of storagetanks

if critical pressure is reached safety valves will open and gas will be vented to atmosphere

4 e.g. loss of overpressure protection

4 2 32 36 Visible inspection Detection pressure monitoring system will give alarm to operator, tank shut-down if critical limit is reached (prior to opening ofsafety valves)

2 2 1 4

40 Pressure monitoring system of storage tanks

Detection

4.2 Overfilling Overfilling 1 Overfilling of storage tanks in case of overfilling, LNG may be pressed through the safety valves and vent lines to atmosphere, big gas cloud

5 e.g. loss of overfilling protection

5 2 50 38 Visible inspection Detection Tank condition is permanentlymonitored by bunker crew on receiving vessel. Pre alarm foroverfilling at 95 %. Bunkering will be stopped automatically by two independent systems at 98,5 % and 99 % filling level (SIGTTO guideline).

2 5 1 10

39 Redundant overfilling protection

Prevention

Revised



Occ

RPNFunction Cause


Date: 05.01.2012 Failure Mode and Effects AnalysisHAZID LNG BunkeringFMEA - Bunker Operation

Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

4.3 Emergency Release System activated

ESD activated 1 Emergency Release System activated

during Emergency Release Disconnection approximately 1,5 l LNG will leak into the drip tray. hard arm or hose crane will go to safe position.

2 e.g. strong relative movements between vessel

3 1 6 2 3 1 6

4.4 Lack of Training see action 1 see action see action see action 11 - 12 Rules - STCW: training of crew should be clearly defined.

4.5 Unclear Responsibilities Unclear Responsibilities 1 see action see action see action 11 - 10 Bunker Procedure: The responsibilities have to be clearly defined in the bunker check lists prior to bunkering.

4.6 Regulation Gaps Regulation Gaps 1 see action see action see action 11 - 11 Legislation: the bunkering must be clearly regulated.



1 Long shut down times (in case of leakage)

larger LNG leakage and big gas cloud, ignition possible

5 LNG leakage 2 1 10 41 gas detection system Detection 5 2 1 10 11 - 9 Design: pressure surge for shut down scenario must be calculated and shut down times shall be optimized accordingly.

4.15 Loads due to snow and icing of the piping


1 Loads due to snow and icing of the piping

icing around the hose, load of hoses will increase, if critical loads are reached, emergency release of piping

3 e.g. high humidity, spray from water curtain

5 1 15 42 piping is designed to handle ice loads

Prevention Piping system is designed to handle ice loads on the piping.

1 5 1 5


see action 1 see action see action see action 11 - 12 Rules - STCW: training of crew should be clearly defined.



1 Crew member falling over board

person will fall in the water of lower vessel, one heavily injured or dead person

4 e.g. falling crew member 4 1 16 4 4 1 16 11 - 13 Bunker Procedure: the bunker vessel must have a safe possibility for transfer of people to the receiving vessel.



FMEA - Bunker Vessel

FMEA - Bunker VesselCore Team:


Sev

Occ Det

RPN

5 Bunker Vessel5.1 External Influences

5.1.1 Fire on Board Fire on Board 1 Fire on the vessel fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release


Prevention sprinkler system for cooling ofstorage tanks and A60 insulation will protect LNG storage

4 3 1 12


Prevention

45 fire detection system Detection5.1.2 Fire - Explosion in machine

spaces - LNG system of vessel

Fire/Explosion on Board 1 Fire/Explosion in the machinery space of LNG system

fire will be extinguished by crew according common procedures, bunkering will be stopped by ESD, normal disconnection or emergency release,


Prevention sprinkler system for cooling ofstorage tanks and A60 insulation will protect LNG storage

4 3 1 12


Prevention

48 fire detection system Detection5.1.9 Big falling objects on the

bunker vessel from terminalFalling Objects 1 Big falling objects on bunker

vessel from terminalBig fallen objects may destroypiping on deck or the coverage of the tank system, LNG leakage and big gas cloud, fire must be assumed on deck area and in the adjacent open spaces, a damage of storage tank of bunker vessel will not be expected.

4 e.g. bottom of container will break, container will fall down

4 1 16 49 Water sprinkler system for cooling of tanks

Prevention Bunker ship will separated by fender system from the vessel(approximately 2 m)emergency shut down of bunkering, sprinkler system for storage tanks activated.Storage tank is protected by safety valves for the fire case

4 4 1 16

50 Safety valves storage tank Prevention5.2 Mooring

5.2.21 Loss of mooring Loss of mooring 1 Loss of one mooring line loss of proper mooring to receiving vessel, bigger relative movements between vessel, bunker connection willleave operation envelope, emergency shut down and disconnection


4 2 24 According sufficient number of mooring lines the probability for overload is lower. A single loss of line should not influence the mooring.

2 3 2 12 11 - 14 Bunker procedure: the bunker vessel should be moored with a sufficient number of mooring lines (comp. and Exxon mooring requirements).Mooring lines should be supplied by bunker vessel (regularly checked).

11 - 15 Bunker Vessel: The manoeuvrability of the bunker vessel should ensure always a safe approach and departure to the receiving vessel under all foreseeable conditions.

Revised



Occ

RPNFunction Cause



FMEA - Bunker Vessel

Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

5.2.22 Release of mooring in wrong way

See failure 3 Collision



1 unintended pressure release location of vent exits in cargo area, big gas cloud assumed, gas cloud may be ignited

5 - mechanical damage of valve 2 1 10 5 2 1 10 11 - 1 For the size off possible gas clouds the SIGTTO study should be checked

11 - 2 Terminal: a gas detection system on the container bridge should be discussed/recommended (alarm, ESD).

11 - 5 Operational Manual: the terminal should be informed, if LNG bunker operations are planned during loading and unloading.

11 - 7 Bunker Standard: a major incident, e.g. big release of gas, should be communicated to the port authority.

5.28 Black-Out Hard arm 1 Black out of bunker vessel hard arm stays in last position, if critical forces are reached connections emergency release couplings will open, mechanical damages can not be excluded. According to black out bunkering has stopped and all valves go to fail safe position, no LNG leakage possible

4 e.g. short cut 3 1 12 4 3 1 12 11 - 8 Hard Arm Design: a second energy source for the hard arm should be considered (emergency switchboard)



FMEA - Waterway River Elbe

FMEA - Waterway River ElbeCore Team:


Sev

Occ Det

RPN

6 Waterway River Elbe6.1 External Influences

6.1.1 Collision Collision 1 Passing vessel collides with ships during bunkering (fore/aft collision, side collision)

bunker vessel will be heavily mechanically damaged, a damage of storage tank will not be assumed (no difference to normal operated vessel), possible break of mooring lines, bunker envelope will be left, Emergency shut down and disconnection of bunker line.

3 failure of passing vessel 4 1 12 3 4 1 12

2 Passing vessel collides with bunker vessel from side (90°),(only smaller vessel assumed (< 160 m), bigger vessel will not turn so quickly, most of the vessel will already supplied by a tug).

Damage of outer shell and LNG storage tank of bunker vessel, LNG leakage and gas cloud, ignition assumed, big fire, low flame velocity, structural damage of ship structure according to leaking LNG, rapid phase transition could be expected.

5 e.g. black out of passing vessel, loss of steering machinery

3 1 15 5 3 1 15 11 - 16 The probability for a collision can be lowered by using defined areas for bunkering or traffic restrictions.It should be considered, that this risk is no specific risk of the bunkering and bunker vessel, but similar to all gas fuelled vessel.

3 Collision of bunker vessel during approach or leave

Vessel will approach with low speed, mechanical damage of the outer hull possible, damage of storage tank and gas system not expected

3 operator failure 4 1 12 vessel is designed for high manoeuvrability. Safety distances of storage tanks to outside are designed for smallcollisions

3 4 1 12

6.1.2 Vessel entering Safety Zone Vessel entering Safety Zone 1 Vessel entering safety zone no effect, no reaction time for crew on bunker vessel and passing vessels, local traffic control may inform passing vessels prior to entering safety zone

2 e.g. wrong master decision 5 2 20 2 5 2 20

Revised



Occ

RPNFunction Cause



FMEA - Waterway River Elbe

Sev

Occ Det

RPN

Revised


Occ

RPNFunction Cause

6.1.14 Surge from passing vessels Surge of passing vessel 1 Surge of passing vessel strong relative movements, loss of one mooring line, loss of proper mooring to receivingvessel, bigger relative movements between vessel, bunker connection will leave operation envelope, emergency shut down and disconnection it could be assumed, that the feeder vessel will lose the mooring to the berth prior to the loss of mooring between feeder and bunker barge.


4 2 24 According sufficient number of mooring lines the probability for overload is lower. A single loss of line should not influence the mooring.

2 3 2 12 11 - 14 Bunker procedure: the bunker vessel should be moored with a sufficient number of mooring lines (comp. and Exxon mooring requirements).Mooring lines should be supplied by bunker vessel (regularly checked).

11 - 15 Bunker Vessel: The manoeuvrability of the bunker vessel should ensure always a safe approach and departure to the receiving vessel under all foreseeable conditions.

6.25 restriction of shipping channel Restriction of shipping channel

1 Restriction of shipping channel

passing traffic may be restricted according to the bunkering procedure

2 e.g. wide of vessel, additional safety distance

5 1 10 Traffic will be organized by local traffic control

2 5 1 10 11 - 6 Operational Manual: the local traffic control should be informed about the planned bunkering.


(HAZID) LNG Bunkering from Bunker Vessel in the Port of Hamburg

Documents

Transcript of (HAZID) LNG Bunkering from Bunker Vessel in the Port of Hamburg